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Abstract 

I show that for any number of oracle lookups up to about 7r/4 \/iV, 
Grover's quantum searching algorithm gives the maximal possible prob- 
ability of finding the desired element. I explain why this is also true for 
quantum algorithms which use measurements during the computation. 
I also show that unfortunately quantum searching cannot be parallelized 
better than by assigning different parts of the search space to independent 
quantum computers. 

1 Quantum searching 

Imagine we have N cases of which only one fulfills our conditions. E.g. we have 
a function which gives 1 only for one out of N possible input values and gives 
otherwise. Often an analysis of the algorithm for calculating the function 
will allow us to find quickly the input value for which the output is 1. Here 
we consider the case where we do not know better than to repeatedly calculate 
the function without looking at the algorithm, e.g. because the function is 
calculated in a black box subroutine into which we are not allowed to look. 
In computer science this is called an oracle. Here I consider only oracles which 
give 1 for exactly one input. Quantum searching for the case with several inputs 
which give 1 and even with an unknown number of such inputs is treated in Q . 

Obviously on a classical computer we have to query the oracle on average 
N/2 times before we find the answer. Grover [pj has given a quantum algorithm 
which can solve the problem in about 7r/4 y/N steps. Bennett et al. Q have 
shown that asymptotically no quantum algorithm can solve the problem in less 
than a number of steps proportional to y/N. Boyer et al. Q] have improved this 
result to show that e.g. for a 50% success probability no quantum algorithm 
can do better than only a few percent faster than Grover's algorithm. I improve 
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the proof, showing that for any number of oracle lookups Grover's algorithm is 
exactly (and not only asymptotically) optimal. 

The abovementioned proofs have shown that asymptotically proportional to 
\/N steps are necessary for quantum searching. They have not said whether 
these steps can only be carried out consecutively or whether they could (par- 
tially) be done in parallel. If they could be done in parallel then a quantum 
computer containing S oracles (thus S physical black boxes) running for T time 
steps could search a search space of 0{S^T^). Now any unstructured search 
problem can simply be parallelized by assigning different parts of the search 
space to independent search engines (whether quantum or classical). But using 
this "trivial" parallelization we can only search a search space of 0{ST^) using 
S independent quantum computers running Grover's algorithm. I show that we 
can not do better. 

Grover's quantum searching algorithm distinguishes between the iV possible 
one- yes oracles (yes = 1) using n/4 ^/N oracle calls (that is, evaluations of 
the function). It makes the same sequence of operations 7r/4 \/N times. The 
sequence consists of 4 simple operations. The input state to the algorithm is 
the (easily constructed) uniform amplitude state: 

1 

initial state Sri — , > \x) (1) 

The \x) are the N — 2^ computational basis states (where every one of the I 
qubits is either or 1) which correspond to the possible inputs to the oracle. 
Thus for Grover's algorithm N has to be a power of 2. Again Q have generalized 
this to arbitrary N . 

The 4 operations of Grover's algorithm are then: 

1. \y) ^ ^\y) foi' the one marked y 

2. 

3. \x) -\x) for all x^Q 

4. 

The first step is really the invocation of the oracle. The input wc arc looking 
for is y. An oracle giving or 1 can easily be changed into an oracle which 
conditionally changes the sign of the input. This can be done by preparing the 
qubit into which the oracle output bit will be XORed in the state (|0) — |l))/-\/2- 
Of course the oracle will need work space, but as we expect these work qubits 
to be reset to their pre-call value after each oracle call, we do not really have 
to care about them in the quantum algorithm as they "factor out" (after the 
oracle call they form a tensor product with the rest of the quantum computer) . 
The requirement that the work qubits have to be "uncomputed" means that 
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the algorithm in the oracle may take longer than its conventional irreversible 
version. 

The second step applies a Hadamard transform to every one of the I qubits 
(shorthand if'). The Hadamard transform is given by the following matrix: 

1/1 1 



The third step changes the sign of all computational basis states except for 
|0) and the forth step is the same as the second. 

The following results are straightforward to obtain: After any number i of 
iterations of these 4 operations the state of the QC can be written as a linear 
combination of two fixed states: 

^i = A^^J^=Y.\x)+B,\y) (3) 

xjty 

One application of the 4 operations gives: 



A,+, = (1-1) A,- 2^^^ 



This is simply a SO (2) rotation with 



2 '\/ N 1 

cos((/?) = 1 - ;^ and sin((^) 2 — — — (4) 

Thus 95 w sincp « 2/\/]V and therefore after 7r/4 \/N steps we obtain a state 
very close to \y). 

It turns out (and is easy to check) that the initial (uniform amplitude) state 
can be written in terms of half the above angle: 

00 = cos(¥>/2) -7^= J2 1^) + sm(^/2) \y) (5) 

Thus the success probability after T oracle calls is exactly 

PT = sm^{Tip + ip/2) . (6) 

(Note that after about 7r/4 y/N iterations of Grover's algorithm the success 
probability goes down again!) 

A noteworthy remark: Actually because towards the end the success prob- 
ability goes very slowly to 1, if we want to minimize the average number of 
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step^, it pays off to end the computation earlier and run the rislc to have to 
start over. A simple calculation shows that the average number can thereby be 
reduced by some 12.14% relative to the above result. 



2 tight bound on quantum searching 

Here I sketch my version of the proof from Q which gave the tightest limit on 
quantum searching so far. It is an extension of the earlier il{y/N) proof in 
Later I obtain my results by further refining the same proof. 

In the proof I assume a quantum computation consisting only of unitary 
transformations (plus the final measurement) without measurements during the 
computation. This can be done without loss of generality: Clearly a measure- 
ment of a qubit whose outcome will not be used to make decisions on what 
further unitary transformations should be applied, can be delayed to the end. 
For a practical QC it seems likely that what further unitary transformations 
will be applied will depend on outcomes of intermediary measurements, like e.g. 
in error correction. Thus we will probably have a "hybrid" quantum-classical 
computer, where the classical part reads measurement outcomes and depending 
on that, controls the exterior fields that induce unitary transforms on the qubits. 
The point now is that in principle the classical part can simply be replaced by 
quantum hardware which does the same. This may use more space as we are 
now restricted to reversible computation, but for what concerns us, it of course 
does not increase the number of oracle invocations, and this is really all we care 
about here. 

So we do not care about the cost of any other unitary transforms, actually 
we do not even ask whether they can efficiently be composed of elementary 
gates. Of course once we have established that even under this general viewpoint 
Grover's algorithm is optimal, we know that the "auxiliary" unitary transforms 
can be realized with just a few elementary gates. Actually I expect that in any 
sensible application of Grover's algorithm these auxiliary operations are going 
to be much easier (and faster) than the oracle call. 

The proof gives a limit on the success probability achievable with T (for time) 
oracle lookups. Thereby we average over the N possible oracles. In computer 
science one is usually interested in the worst case, that is the oracle for which 
the success probability is the smallest. Because the worst case probability is 
smaller or equal to the average case probability we also get an upper limit on 
the former. In Grover's algorithm the success probability is independent of the 
oracle so the worst case and average case probabilities are the same and thus 
Grover's algorithm is also optimal for the worst case probability. 

The proof works by analyzing how the difference of the QC states between 
the cases when we have a specific one- yes oracle and when we have the empty 
oracle (always giving 0) evolves. For the empty oracle case I denote the QC 

^as opposed to the maximum (worst case) number of steps 
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state after i oracle invocations by (jii whereas (jy^ denotes this state when we 
have an oracle that gives yes only for input y. More precisely, these are the QC 
states just before the next oracle call, thus in one register of the QC there must 
be the input to the oracle. 

The proof consists of two parts. The central part of the proof gives a bound 
on how far from the empty-oracle case the state can have diverged after T oracle 
calls when the oracle has one yes. To get a meaningful statement we have to 
average over all possible one-yes oracles, as for any given y a special algorithm 
could be made that would do especially well for this case. The statement is: 

N-l 

The second part of the proof gives an upper bound on the success probability p 
in terms of the left hand side of the above equation: 

, 1 

2N - 2Vn^ - 2\/iV\/]V^^l - p < ^|0|,-0Tp (8) 

Where the "1." above the "<" is for later discussion. I prove this inequality in 
the appendix, as it is not central to the understanding of the proof. 

Both inequalities together then give the desired lower bound on T in terms 
of N and p. Asymptotically and for p = 1 the statement is T > y/ N/2 . I now 
derive the "central" inequality 0. To simplify the notation I assume that, like 
in Grover's algorithm, in every iteration (each containing one oracle invocation) 
the quantum computer makes the same sequence of operations. It is easy to see 
that the proof works just as well without this restriction (just add additional 
indices to U and Uy). By 

AU -Uy (9) 

I denote the difference between the unitary transformation corresponding to the 
empty oracle and the unitary transformation corresponding to the oracle giving 
1 only for input y. The transformations U and Uy will act identically on all 
computational basis states except those where the register holding the input 
to the oracle is in state y. To get an upper bound on — consider the 
following: 

4>T - iUy + AU)(bT-l=UyiUy + AU)(bT-2 + AU(j)T-l = --- (W) 

T-1 

= c|)li.+ J2iUvyAU<PT-l-^ (11) 

1=0 

Then 
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I 



i=0 



2. 

< 



,T-1- 



'AU<l,i\ = 



Where Py is the projector onto those computational basis states which are going 
to query the oracle on input y. The numbering of the inequality signs is again 

for later discussion. For the next step I need the inequality {^ai)'^ < T'^a^, 
where the Cj's are any T real numbers. It follows from the equality 



which is easy to verify. So now we get: 



\rT-<l>T\'< 



By summing this over all y's we get: 

AT-l 



(12) 



(13) 



(14) 



I V 



3 improving this bound 

To sec how tight the above inequality is, let us look at the 4 (numbered) in- 
equalities in the proof which arc then concatenated to yield the final inequality. 
Let us see how well Grover"s algorithm (after any number of steps and for any 
marked y) docs on these 4 inequalities. It turns out that it saturates all but 
the 2. inequality. For the 1. inequality this is shown in the appendix. The 
3. (in)equality is easily verified. It is true because in the first of Grover's 4 
operations the sign of \y) is changed, thus maximizing the distance between \y) 
and — \y)- The 4. inequality is saturated because for Grover's algorithm the (f)iS 
are all identical. So let us now concentrate on the 2. inequality: 



E (t/,)^-i-A/70, 



< E l(C/.f-'-*A/7<^,| (15) 



For Grover's algorithm, U is the identity and thus ^, = ^O) so 
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AU 0, = 2Py 4>, = ^ |y) (16) 

As mentioned before, Uy just carries out a SO (2) rotation on the space spanned 
by \y) and l/\/N — 1 J2x^y l-^)- Thus for Grover's algorithm the vectors in 
inequahty #2 do not all point in the same direction, rather if drawn one after the 
other (to form the vector sum) they form an arc. This prevents the inequality 
from being saturated and explains the discrepancy of the tight bound in from 
the performance of Grover's algorithm. 

So let us try to find a tighter (upper) bound on — (f>T\- To this end 
I write equation |l^ a little bit differently (where of course T does not mean 
"transpose" !): 



(f>T = [U <j)T-l - Uy 0T-l) + [UyU (j)T-2 - UyUy (f>T-2) + ■■■ 

... + {{Uyf-^U cj)o-{Uyf M + ct^^r 

This has the form 



tpo-'^T = {ipo - V'l) + ("01 - ^^2) + (-02 - V'3) + • ■ • + (V'T-i - ipr) (17) 

where all ipi^s are normalized. The question now is how we have to choose 
ipi, 02, ■ • ■ V'T-i in order to minimize ^ — ipi+il'^ when -00 and ipT are fixed. 
Note that the relative phases of different states of the QC have no physical 
meaning and are therefore only a matter of convention. This is because quantum 
states are really given by 1-dimensional subspaces (rays) of a Hilbert space and 
not by vectors. We can thus assume that (■0o|V't) is real and non-negative.0 
Intuitively it is clear that for the minimum the ipi^s have to be evenly spaced 
along the arc between -0o and ipT- (Note that this is obviously the case for 
Grover's algorithm!) Formally this can be established by setting the derivative 
with respect to the components of ipi equal to zero, which yields: 

We can imagine all these vectors to lie in a 2-dimensional real vector space 
spanned by 0o and ipx- From planar trigonometry we then get (draw a picture 
with a line bisecting the angle between ■0o and ipr)'- 

IV'o-V'T|'=(2sin(|))' =^ |^,_^,^,|2=(2sin(^))' (19) 



^Actually it would be nicer to write the proof in terms of absolute values of scalar products 
only, thus avoiding unphysical quantities like the difference of state vectors 
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Where a is the angle between ipo and '0t and a/T the angle between ipi and 
for all i. 

So we now have that (compare to equation p^ ) 

[(^T-^^P < / (^4r^|P,(/.,p ^ yy (20) 



where f{x) describes the improvement in our bound. It is given by (T is a fixed 
parameter) 

/( 4T2sin2(^) )=4sin2(a/2) (21) 



We now want to sum equation ^ over all ?/'s. We use calculus to get an 
upper bound on the sum over the right hand side. I claim: 



V y \ i / \ y i / 

(22) 

We know that we have an absolute (and not only a relative) maximum on the 
right hand side because in the whole area of interest /' > and /" < 0. More 
precisely, /' > is true exactly as long as the number of steps T in Grover's algo- 
rithm is below the (fractional) optimum (which can be obtained from equation 
of about 7r/4\/]V. The above inequality is saturated by Grover's algorithm as 
there the above optimal situation with equal angles between successive vectors 
is realized with this constant angle equal to (p given in equation IJ. Thus we 
have established that Grover's algorithm is optimal. 



4 Limits on parallelizing Grover's algorithm 

Assume we have S {S for "space") identical oracles with exactly one marked 
element. Thus we can imagine that we have 5" identically constructed physical 
black boxes. In particular I assume that all oracles take the same time to answer 
a query. 

We want to find the fastest way to obtain the marked element with a quan- 
tum computer that is allowed to use all these oracles (and may input entangled 
states to them). To formalize this in a "query complexity" way and assum- 
ing that querying will take much more time than the other operations in the 
algorithm, I only consider the "querying time" , which is the time during the 
algorithm when any one of the oracles is working. 

The quantum computer could query the individual oracles at any time, in 
particular it can start querying an oracle while another one is still running. In 
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the following I give an argument that without loss of potential power of the 
algorithm, we can assume that the oracles are always queried synchronously. 

First imagine that we have just 2 oracles. We begin by querying the first 
one and while it is still working we start querying the second one. We can 
assume that while an oracle is working, only the oracle interacts with its input 
register. (If necessary, this can be assured by XORing the input state to a 
register reserved for the oracle.) Then it follows that the second oracle could 
be queried as soon as the first one, possibly by doing some preparatory gates 
ahead of time. 

Now imagine we have S oracles. First consider the very first querying of 
an oracle in the algorithm. All the oracles which we start querying while the 
first one is still working can, by the above argument, be queried simultaneously 
with the first one. As there is no point in not using the other oracles during 
this time, we can assume that we start the algorithm by querying all S oracles 
simultaneously. 

By applying the same argument to what happens after this first step, we get 
that we can assume that the second step also consists of querying all S oracles 
simultaneously. By iterating this we see that we can assume that the algorithm 
always queries all oracles simultaneously. Say it does this T times. 

As before (equation we have 



V \ y i / y i 



Pycp,\'' (23) 



Where on the right I have also included the old unimproved result. Here (pi is 
the QC state just before the S oracles are called (for the « + 1 -st time). Now Py 
is the projector onto those computational basis states where any oracle (possibly 
several ones) is queried on input y. 
It is easy to see that: 

s 

Wycj^^? < El^^^l' (24) 

fc=l 

Here Py is the projector onto those computational basis states where oracle 
number k is queried on input y. The inequality becomes an equality when there 
are no basis states in where several oracles are queried on input y. 
From that we get (compare to equation [l^): 

EEi^.'^'i' ^ EI:Ei^.'>^i' = ^-^ (25) 

V i=0 



So we get the final result 
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Y,\<i^T-4>l? < Nfi-AT'Sj < S-AT' (26) 

This shows that to get a certain success probabihty we can gain only a factor of 
in T by using S oracles, but this is essentially the same performance as S 
independent Grover searches, each working on one ^'''of the total search space. 
If A*" (the size of the search space) is divisible by S this is an exact statement, 
otherwise we still get an asymptotic statement. 



5 Appendices 

5.1 proof of inequality § 

The situation is as follows: a quantum system is in one of A'' pure states given by 
the normalized vectors ipy, y = . . . N — 1. The task is to find in which of these 
states it is by using any measurement procedure allowed by quantum theory. It 
is well known that if the ipy^^ iiot all pairwise orthogonal, this can only be 
done probabilistically (see e.g. Q). Here we are interested in maximizing the 
average success probability when averaging over all cases. We want to prove 
the following upper bound on this probability p: 

2N - 2VNy^ - 2VNy/l^r^y/l - p < ^IV'a-V'P (27) 

Measurement schemes can in general be such that when the measurement gives 
y then one is sure that the state was ipy, but then in general the answer can also 
be "I do not know" . Here we are not interested in such schemes. Because once 
we get an answer we can easily check whether it is correct, all we are interested 
in, is to maximize the probability of getting the right answer, irrespective of 
whether an unsuccessful measurement yields a wrong answer or "do not know" . 

5.1.1 Grover's algorithm saturates the inequality 

Here the ipy^s are the different final states (depending on the oracle) of the QC 
just before measurement and is the state we get for the "zero" -oracle. After 
any number of iterations of Grover's algorithm these states can be written in 
terms of some p as: 

i'y = Vp \y) + V'^-p _ ^ \y"^ ^ 

It is now easy to verify that inequality is saturated. 
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5.1.2 proof of the inequality 



In general the Hilbert space of the QC will have dimension M > N. We must as- 
sume this because it may in general gives the possibility of a measurement with 
a larger success probability. On the other hand a von Neumann measurement 
on such an enlarged space is really the best we can do (|^). A von Neumann 
measurement is just a standard quantum measurement given by a hermitian op- 
erator or, essentially equivalently, by a set of (mutually orthogonal) eigenspaces 
which together span the whole Hilbert space. I write the tpy's and ip as follows 
in terms of some basis |m): 

M~l M-1 

■0y = X! '^ml"^) ^^"^ '/^ ^ X! (29) 

m— m— 

Without loss of generality we can assume that we measure in the basis \m). I 
denote by My the set of m's which, when we obtain them from a measurement, 
will be interpreted as answer "y" . By py I denote the probability of therby 
correctly identifying the state ipy: 

m G My 

To prove inequality ^ we look for the minimal value its right hand side can 
assume for a given p = ^/N'Y^yPy. We do the minimization in two steps. First 
we find the ijjy (= the cj'„'s) for which j-^y — -01^ is minimal for a given fixed 
Py and Tp. Using the Lagrange multiplier technique to find (tentative) extrema 
under some constraint we get the expression: 



M-l M-1 

m— m—Q m^My 

where the first constraint (Lagrange multiplier Ai) comes from the requirement 
that '0y be normalized and the second (Lagrange multiplier A2) because we want 
to minimize for fixed Py. To find candidate extrema we set the derivatives of 
this expression with respect to the real and imaginary parts of equal to zero. 
The well known "trick" that in this case one can formally treat the complex 
variable and its complex conjugate as the 2 independent real variables simplifies 
the calculation to obtain: 

c™ = (1 - Ai - A2)c^ -im^My and c,„ = (1 - Ai)c^ ^ m My (32) 
By satisfying the constraints we get: 
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1-Ai-A2=±^ 1-Ai=±^^=^ where ay = Y |c™|2(33) 
From that we get the following 4 candidates for a minimum: 

\^Py - VP - 2 - 2 {±^^± yr^^yr^) (34) 

Of course the minimum is reached when both signs are positive. Note that we 
do not have to worry that \ipy — might be even smaller on some boundary of 
the parameter range we minimized over. This is because our parameter range 
(under the constraints) does not have a boundary, thus it is a bona fide manifold. 
Also our coordinate system is regular all over the manifold. By summing over 
y we get: 

^|Vj,-VP > 2N-2Y,{Vp^V^+V^~P^V^~^) (35) 

y y 

Now we look for the tp {— the a^'s) and the Py^s for which this becomes minimal. 
We have the constraints \tp\'^ = ^ |cmP = J2'^y — ^ ^/^^yPy = P for a 
fixed p. Again using the Lagrange multiplier technique we get ay = 1 /N Vy and 
Py — p \fy. Then: 

N-l 

Y \i^y - V'P = 2A^ - 2V^VP - ^VnVN -\^\-p (36) 

This time the parameter range over which we have minimized does have a bound- 
ary. The boundary is reached when one of the a^'s or pyS is either or 1. Still 
we can show that we have really found a global minimum by showing that the 
second derivative is positive definite over the whole parameter range. To avoid 
having to adapt this argument to the situation with constraints, we can e.g. 
set po — — J2y=£oPy ^^"i ao ^ I — J2y^Q and then check that the second 
derivative of the right hand side of equation is always positive definite. 

6 final remarks 

I have here only considered oracles with the promise that there is exactly one 
marked element. It seems very plausible that the proof can be extended to 
oracles with any known(!) number of marked elements. The same may be true 
for the case where we have a non-uniform a priori probability for the different 
1-yes oracles and we want to maximize the average success probability. Then 
one also has to consider a modified Grover algorithm. 

Also it seems that by reading the proof carefully, one can establish that 
Grover's algorithm is essentially the only optimal algorithm. 
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As for any no-go theorem which claims imphcations for the physical world, 
we must be careful about the assumptions we made. Arguably the main as- 
sumption made here is that the time evolution of quantum states is exactly 
linear as of course it is in standard quantum theory. Most physicists think this 
is very likely. 

I would like to thank Manny Knill and Daniel Gottesman for helpful discus- 
sions. 
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